work items grooming for "Add COSE support"

[yizha1]

There is an existing issue addressing COSE support #163. But it may not contain all the work items needed to complete COSE support. The purpose of this thread is to discuss and agree on the work items needed for "Add COSE support" including documents and create issues accordingly for each item if they are not there yet.

[dtzar]

In terms of high-level scope - I'd like all the user stories we have defined for RC-1 to work with the COSE format. There is work across all three notation* repositories to make this work and it needs to be broken down into manageable chunks for an engineer to implement. Once we have more of this detail, I'm fine to update the 163 issue with these tasks to track there for the completion. If desired, we could define what of the user stories should work as things progress for implementation.

[yizha1]

Here are proposed work items:

1. Create spec signature-envelope-cose.md in main branch and update other related specs
2. Support COSE envelope in notation and notation-go as built-in signature envelope
3. Add support of COSE envelope for signing and verification plugins https://github.com/notaryproject/notaryproject/blob/main/specs/plugin-extensibility.md
4. Discussion on removing JWS envelope support

[SteveLasker]

Thanks @yizha1

• The current cose work is now updated in https://github.com/notaryproject/notaryproject/tree/cose-envelope Thanks @letmaik
• we still need to expand this to support multiple payload types, including an oci/oras descriptor, loose files by hash, and encapsulated content
• We have agreed to keep the current jws and add cose, so notation will support both. At a future date we may translation to defaulting to one, but we needed to ship jws for stability as we finalized the cose support.

[yizha1]

Here are the proposed break-down issues for "Add COSE support". We could create a roadmap issue in roadmap repo and link below issues there.

User story or feature level, utilizing existing issue notaryproject/specifications#117

• Implement signing artifacts with signatures enclosed in COSE envelope (repo: notation-core-go/notation-go)
• Implement verification of signatures enclosed in COSE envelope (repo: notation-core-go/notation-go)
• Implement notation CLI with support of signature in COSE envelope (repo: notation)
• Implement plugin signing artifacts with signatures enclosed in COSE envelope (repo: notation-core-go/notation-go)
• Implement plugin verification of signatures enclosed in COSE envelope (repo: notation-core-go/notation-go)

There are also existing issues related to "Add COSE support", we can discuss how to handle these issues.

• Add COSE support #163

[dtzar]

This looks good @yizha1. We should add/modify items to match your list here as well as modify 163. Then we just need one item to track all of these updates for the e2e feature completion. Ideally it would be a user story in roadmap repo.

[yizha1]

Thanks @dtzar.
@iamsamirzon I will create a user story for COSE support in roadmap repo, which will be used to track all other issues of COSE support. Any comments from your side?

[iamsamirzon]

@yizha1 - There is an existing roadmap item, I suggest, go ahead and repurpose this item and convert it into a user story for COSE related support. notaryproject/roadmap#7

[FeynmanZhou]

@yizha1 Should CLI command UX spec be included in the item/issue list?

[yizha1]

We may need to update the exsiting CLI spec for COSE support, but we may not be able to do big UX improvement according to the release timeline, we can make necessary changes, and leave the UX improvement for next step. I can add these comments to the following issue once it is created. Thanks.

• Implement notation CLI with support of signature in COSE envelope (repo: notation)